Hacker News Reader

Comment by tptacek | Hacker News Reader

Because once you have the schema you can issue FOIA requests that include queries for them to run.

Is the schema considered private information or just information not required to be released via FOIA? ie: Can't some nice employee leak this information or is it legally protected?

Once the information is released, can anyone can make FOIA requests using the schema?

Under Illinois law there are just two kinds of data: normal data and data exempt from FOIA. Up to and including the appellate review of Matt's case, schemas were in the formal, normal category. After the State Supreme Court review, they are now per se exempt from FOIA.

It's not legally protected. An employee could leak it. A public body can voluntarily reveal documents that are exempt from FOIA (absent some other Illinois law prohibiting disclosure). A public body can disclose source code, for instance, despite it being explicitly exempt in the statute. "This data is exempt" is an affirmative defense that the public body has to raise.

What if you guess common table names? Wonder if they send back the error message.

Could you ask them to run an introspection query? Something like SELECT * FROM information_schema.tables?

Oh wow! If that is necessary, that is so kafkaesque!

"I want your data"

"What data?"

"What do you have?"

"Ha ha. No. Tell me what you want"

"Your data that is the metadata of your data"

"Well actually..."

...

You can't ask public bodies to do research for you. That's the public policy balance in our FOIA laws: you can get almost anything (and: talk to Matt, you really can get a lot of stuff), but you have to be specific about what you're asking for, and it has to be "at hand" for the staff responding to the request.

Clerks fielding FOIA requests have SQL consoles "at hand"?

They send emails to IT. The classic example of a thing you can get through FOIA is large-scale dumps of emails from Exchange Servers, which is also not something a Clerk can do themselves, but which IT staff can immediately retrieve.

Leave the "Clerk" bit of this out and just imagine you're requesting straight from the IT department. What you can do: get anything not otherwise exempt that they know how to retrieve (it usually helps to provide example commands in the requests). What you cannot do: ask them to go look around and see what they have. That's research. Research is your job, not theirs, under Illinois FOIA.

If research is my job, and looking around is research, then couldn't I look around and see what they have instead of asking them to do so?

Maybe? If you work there, I guess? Or if you're really nice to them? But they're under no obligation to help you. The tradeoff in Illinois (and most other good FOIA law): you can get almost anything you want --- way more than most people think --- but you can't get public staff to go do research work for you.

Again: this is why pulling schemas is so valuable.

Reply on news.ycombinator.com